Scope chapter quiz
Seventeen questions on Scope. Push your thinking on boundaries, restraint, regulatory clocks, processor duties, entity prioritization, identity boundaries, and the Uncover handoff.
Scope chapter quiz
Pick the answer that best matches the methodology.
A confirmed compromise of a system processing payment card data is detected. The technical investigation will take days. What does Scope require the analyst to do about timing?
Card-brand rules, not PCI DSS itself, set the notification deadlines, and they are short and run from reasonable suspicion: Visa requires a report within three calendar days, routed through the acquirer, and American Express requires notice immediately and no later than 72 hours. Each brand sets its own rules and acquirer contracts can be stricter, so the figure that binds you (Mastercard's included) comes from your acquirer agreement. That clock runs from suspicion, not from the end of a days-long investigation, so waiting for accuracy or for proof that data left both miss it. Analysts do not start or stop the clocks; law and contract do. Scope's job is to recognize the obligation, engage compliance, and commit the timestamp so compliance can run the clock in parallel with the technical work. Deferring it until a case reaches IR spends days the clock does not give back.
Review: Regulatory boundaries: PCI DSS
An alert looks like a phishing-driven intrusion. The message trace shows the lure arrived five days before the alert fired. Where does Scope set the backward edge of the primary window?
The window follows the threat type and the evidence, not the alert time. The 24-to-72-hour default for phishing assumes initial access was recent; when the evidence shows the lure landed five days earlier, the backward edge moves to that artifact, and the worked examples pair the primary window with a longer look at the primary entities (4 weeks in the finance-team case) to rule out earlier staging. Stopping at 72 hours cuts off the delivery and everything between it and the alert. Starting at execution misses the delivery and any reconnaissance. Reading back to the start of retention is the opposite error: a window with no evidence-based edge is a fishing expedition.
An alert on a build-pipeline service account smells like possible supply-chain compromise. What historical window does Scope set?
The window follows the threat type, not a default. Supply-chain compromises often predate their first alert by weeks or months: the malicious component may have shipped in an update long since deployed. The 1-to-6-month window is bounded by what the SOC actually retains, and if retention falls short, the gap is documented in the Scope output rather than ignored. The insider option borrows the right length of window for the wrong reason: a compromised pipeline is not an insider.
The Subject phase identified seven identities connected to the alert. How many should be primary in scope?
Primary entities are those directly involved in the alert, plus any other credential of the same principal that the compromise could plausibly carry over to (which is why dlin's federated cloud identity is primary in the worked example). Secondary entities are connected through trust paths but not in the alert. The split keeps investigation depth proportional to evidence rather than spending equal time on every identity in the map. A fixed count, high or low, ignores the evidence the split is supposed to follow.
Alert and Subject both lean benign on a developer-workstation alert, but the user's account can reach a dozen other systems. How does Scope draw the boundary?
This is restraint scoping, and it is as much a Scope skill as expansion. Access alone is topology, not evidence, and every entity added spends Uncover's depth where there is no signal. The narrow boundary is defensible precisely because the expansion path exists: if Uncover surfaces evidence touching another system, the decision tree grows the boundary with a documented justification. Restraint is not the same as skipping checks: a bounded check that answers the verdict question, like the extension-layer check in the Cursor case, stays in. Sprawl on a benign-leaning case is how a fast close becomes a five-hour one.
An investigation needs in-app activity from a SaaS platform, but the SOC only has authentication logs and aggregate API call counts. What does Scope require?
Naming what cannot be seen is part of Scope. It prevents wasted effort on impossible queries, it keeps the record from reading a gap as quiet, and it lets the analyst submit vendor or external-team requests early so the data arrives in parallel. Pausing the case for the vendor stalls everything else the boundary allows Uncover to do.
A hospital SOC confirms a compromised workstation had access to systems holding PHI. When does HIPAA's 60-day individual-notification clock start?
The 60-day clock (45 CFR §164.404) runs from discovery, not from confirmation; discovery is a knew-or-should-have-known standard applied to the whole workforce. The alert that starts triage can be the discovery event, which is why Scope commits the timestamp and engages the privacy officer early. The four-factor assessment (§164.402) decides whether notification is required at all; it does not pause the clock. Sixty days is the outer limit; the standard is without unreasonable delay.
Review: Regulatory boundaries: HIPAA
During Scope, the analyst confirms that a compromised account assumed a cloud role during the investigation window. The decision-tree response is...
The IF/THEN decision-tree pattern is Scope's structured way of evolving the boundary. A cloud-role assumption is evidence; the methodology says incorporate it now and document the three-line justification (evidence, risk, required actions) so the expansion is defensible. The role itself gets full depth and the resources it can reach start at baseline, upgraded on any signal. Waiting for Uncover to surface it would mean Uncover queries outside its own scope to find what Scope should have already framed.
Scope confirms a compromised identity can reach systems inside the cardholder data environment (CDE). What does the methodology require?
Card-brand clocks run from reasonable suspicion, not confirmation (Visa: a report within three calendar days; American Express: no later than 72 hours), and they reach the brands through the acquirer, so the acquirer-relationship owner hears the same day. A PCI Forensic Investigator may later re-examine everything preserved in the first hours. If the environment actually meets PCI DSS v4.0.1 Req. 10.5.1 (at least 12 months of audit-log history, the most recent three months immediately available), that is the minimum look-back to expect, but a requirement is not a guarantee: verify that the CDE logs for the window exist and were not tampered with before relying on them. Identifying what will rotate or be cleaned up before the case can use it, and requesting the retention extension or hold through the owning team, is still the analyst's job. Investigative access into the CDE follows the same least-privilege controls as any other access: defaulting to full access is exactly backwards.
Review: Regulatory boundaries: PCI DSS
A US SOC investigates a compromised account belonging to an employee in Germany, with the relevant logs stored in an EU region. What does Scope's sovereignty boundary require?
Cross-border rules can restrict moving or even remotely viewing log data. GDPR Chapter V treats access from the US as a transfer that needs a valid mechanism (an adequacy decision or standard contractual clauses), some contracts and national laws impose true residency, and for German staff a works-council agreement may limit what can be examined at all. Scope is where that constraint is recognized, because discovering it mid-Uncover means evidence already moved where it should not have. The anonymize option fails because stripping usernames is pseudonymization, not anonymization: data that can be re-linked to a person remains personal data (GDPR Recital 26), so the constraint still applies.
Review: Infrastructure boundaries: five kinds of infrastructure edge
Every handoff in the worked example lists open questions for Uncover. Why does Scope include them?
Each open question in the worked example maps to a query Uncover can run. Case C's handoff asks what the session and the app actually read, whether the attacker reached payment threads or the CRM, and whether the tenant sweeps surface other sessions, grants or exposed accounts; Uncover answers each one from the audit log and the sweep. Framing the questions before the data is pulled is what keeps Uncover from running broad queries and hoping. The format and audit options describe side effects, not the purpose, and Uncover reads Subject's findings directly.
Review: Transition to Uncover: framing the Uncover questions
An identity-only case has no host in question: a replayed session, an OAuth consent grant, and a hiding inbox rule, all in a SaaS tenant. What does the infrastructure boundary consist of?
When the infrastructure is someone else's cloud, the boundary is a query set: which sessions, which grants, which mailboxes, over which windows. Case C writes the tenant sweep (proxy-IP sign-ins, attacker-ASN sessions, same-app consents, same-shape rules, MFA registrations) into the boundary so Uncover runs it once, deliberately. The laptop option scopes the wrong plane: rvega's laptop was examined and cleared. Holding every reachable tenant in scope is topology, not evidence, and 'no perimeter' is how an identity case sprawls.
Scope wants six months of SaaS audit history for a user, but the platform keeps 90 days. The query for the older period returns no rows. What goes in the record?
A query against logs that were never kept returns nothing, and nothing looks exactly like a clean result. That is why Scope checks retention before Uncover runs the query. The dark period is a visibility gap: it is named in the boundary statement, it lowers confidence (unknown is not Low), and it is never written up as 'no activity'. Quietly shortening the window hides the gap the record exists to show, and deferring it leaves Uncover and Risk reading silence as evidence.
A compromised mailbox holds customer personal data, some of it about people in the EU. Nothing is yet known to have left the tenant. When does GDPR's 72-hour authority-notification clock start?
Article 33's clock runs from awareness, which the EDPB describes as a reasonable degree of certainty that a security incident has compromised personal data. Unauthorized access is a breach of confidentiality even if nothing left, so 'no exfiltration, no breach' is wrong. The DPO's assessment decides whether to notify, and it has to happen inside the 72 hours, not before they start. In the worked example, Scope records 09:22 as the candidate awareness timestamp in the token-theft case for exactly this reason.
Review: Regulatory boundaries: GDPR
At a US public company, a cyber incident may be material. When is the Form 8-K Item 1.05 disclosure due?
Item 1.05 runs from the company's determination that the incident is material, and that determination must itself be made without unreasonable delay after discovery. Disclosure counsel and executives make the materiality call, but they make it from the case record: scope of access, data classes, business functions affected. Vague or missing facts slow a determination the SEC expects promptly, which is why Scope commits them early rather than waiting for the investigation to finish.
A breach exposes personal information of California residents. Under California's breach-notification law as amended effective 1 January 2026, when must residents be notified?
SB 446 amended Cal. Civ. Code §1798.82, effective 1 January 2026: residents must be notified within 30 calendar days of discovery, and delay is allowed only at law enforcement's request or as needed to determine the breach's scope and restore the system's integrity. When more than 500 residents are notified, a sample notice goes to the Attorney General within 15 days of notifying them. The older 'most expedient time possible' wording, with no fixed clock, is out of date. Scope's contribution is the same as for every regime: the discovery timestamp and the categories of personal information in reach.
Your company hosts a customer's personal data as their processor. Scope finds that an attacker plausibly read some of it. What does GDPR Article 33 expect from your side?
Article 33(2) gives a processor one duty: notify the controller without undue delay after becoming aware of the breach. The controller is generally treated as aware once its processor tells it, so its 72 hours start from your notice, and every hour your side sits on the finding comes out of the customer's window. Many data-processing agreements set a shorter contractual deadline that runs from your discovery. Notifying the authority is the controller's call (Art. 33(1)), not yours. Waiting for exfiltration repeats the confirmation error: unauthorized access is already a breach of confidentiality. Scope's part is the same as always: commit the timestamp, and get the privacy owner who holds the agreement into the case.
Review: Regulatory boundaries: GDPR
Worth revisiting
Technical details verified . Product names, defaults and retention change; check your own tenant.